[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f-qPM7R89wGLviwvEdWyYHV2iOuxoo462t0VsURFYiqk":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"aa50b321-1023-4108-93b1-9ad53d477d54","fake-github-stars-and-virustotal-reviews-used-to-legitimize-crypto-stealing-malware","0c5778b4-26e8-4e9a-a533-d60b25fe5380","Fake GitHub Stars and VirusTotal Reviews Used to Legitimize Crypto-Stealing Malware","Threat actors are exploiting the implicit trust users place in community-validated platforms like GitHub and VirusTotal by artificially inflating star counts and posting fake reviews to make malicious software appear legitimate. The malware — a cryptocurrency clipper — silently replaces wallet addresses copied to the clipboard, redirecting funds to attacker-controlled wallets without the victim's knowledge. This campaign highlights a dangerous gap in security awareness: users routinely treat social proof signals (stars, ratings, reviews) as proxies for safety without independent verification. Supply chain integrity is also undermined when development platforms can be gamed to distribute malware as if it were trusted open-source software. The use of AI-generated narrators and promotional articles further demonstrates how low-cost deception techniques are scaling social engineering attacks.","**Immediate actions:**\n- Verify any downloaded tool or repository against multiple independent sources before execution, never relying solely on star counts or review scores.\n- Enable clipboard monitoring or endpoint protection capable of detecting and alerting on clipboard hijacking behavior.\n- Cross-check cryptocurrency wallet addresses character-by-character before confirming any transaction, especially after a paste operation.\n\n**Long-term improvements:**\n- Establish a software allowlist policy so only vetted, organization-approved tools can be installed on endpoints.\n- Implement Security Awareness Training that specifically covers social proof manipulation, fake legitimacy signals, and AI-generated deception tactics.\n- Adopt a formal supply chain risk management process requiring provenance verification (e.g., code signing, SBOM review) for all third-party tools.\n\n**Detection measures:**\n- Deploy endpoint detection and response (EDR) solutions configured to flag clipboard-modifying processes and suspicious script execution.\n- Monitor for anomalous outbound network connections from newly installed or unknown applications.\n- Subscribe to threat intelligence feeds that track malware campaigns abusing developer platforms like GitHub and VirusTotal.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 14: Security Awareness and Skills Training","CIS Control 10: Malware Defenses","NIST SP 800-161: Supply Chain Risk Management","NIST SP 800-50: Security Awareness Training","NIST CSF DE.CM-4: Malicious Code Detection","NIST SA-12: Supply Chain Protection","MITRE ATT&CK T1115: Clipboard Data","MITRE ATT&CK T1608.003: Upload Malware to Code Repository","GDPR Article 32: Security of Processing (for organizations handling user crypto assets)",{},"published","2026-06-22T14:21:45.974383+00:00","2026-06-22T14:21:45.814+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fhackread.com\u002Fscammers-fake-github-virustotal-crypto-clipper\u002F","scammers-use-fake-github-stars-virustotal-reviews-to-spread-crypto-clipper-51e3e2","Scammers Use Fake GitHub Stars, VirusTotal Reviews to Spread Crypto Clipper",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":44,"name":45,"slug":46,"description":47,"color":48},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[51,55,59],{"slug":52,"name":53,"problem":54},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":56,"name":57,"problem":58},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",{"slug":60,"name":61,"problem":62},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]